Hot answers tagged

19

You may capture the traffic with packet sniffer to capture all the communications of client\server application, or You may use reverse proxy to intercept and alter data in real time. In simple words, network sniffers allow You to see data flow between client and server, analyse it and reverse the protocol communications Reverse proxy intercept communication ...


13

I wrote a small Python script to deobfuscate the majority of the string obfuscation: import urllib import re php = urllib.urlopen("http://pastebin.com/raw.php?i=wVs8w44v").read() # Slight modification below so that we don't escape $ z26 = "jmiO@sxhFnD>J\r/u+RcHz3}g\nd{^8 ?eVwl_T\\\t|N5q)LobU]40!p%,rC-97k<'y=W:P$1BI&S6\"E(K`Y~.Q;f[v2a#X*ZAGtM" # ...


8

According to this link, it should be possible to find the function in use with the following steps: Attach gdb to the currently-running PHP process: gdb -p <processid> Load in the PHP .gdbinit file for your version of PHP (available from here) Use the zbacktrace command to display the currently-running PHP script For example: gdb -p 4584 (gdb) ...


8

I would recommend using virtual machines to test your sample. If the sample is going to be interacting with other machines (for example, if it sends mail but the mail server is located at mail.example.com) then you will probably want to emulate a two machine setup. If everything is already configured on the machine where your sample will be running (so mail ...


7

There are a couple of ways that come to mind. The first would be to use a network packet analyzer on the actual client running the application. Some well known packet analyzers are Wireshark, tcpdump, and even Microsoft Network Monitor. Another alternative would be to intercept the traffic via man-in-the-middle (M. The easiest way to do this (if you control ...


5

You may be able to use the open-source FakeNet to simulate a real network. However, FakeNet is designed to be run on an XP SP3 system, so using it would require you to ensure traffic is routed from your Ubuntu system/VM to an XP sp3 system/VM. There are likely some Linux based FakeNet alternatives out there, but I've used FakeNet before when analyzing ...


5

If the network traffic is in "plain text" (not encrypted) then a network sniffer such as Wireshark is ideal. If the network traffic is encrypted via SSL but you have the private key (or if the client application does not validate the server's public key) then you can use a proxy such as Burp. If the network traffic is encrypted via SSL and you don't have ...


5

Just before posting this answer I realized he's asking how to do this on windows and my answers is for Mac. I'm posting it regardless because I believe it might be useful for others trying to perform the same thing but then using a Mac If you're using a Mac, then it's really easy by the combination of a Remote Virtual Interface (rvi) and Wireshark. Note ...


5

A more general solution is to use something like runkit, a PHP extension to intercept arbitrary function calls. Rather than trying to simulate a network (the safer option for your situation), if you instead knew the complete set of functions that you wanted to prevent from being called, you could simply runkit_function_redefine each to log a message instead.


4

Another option that's pointed out in the comments above by @CallMeV is to use hooking. On Windows you may look at using EasyHook.


3

Since you already have the source file, I believe that there is a simpler and easier approach (as compared to rerouting network traffic on low levels would be to intercept the methods being called.) Firstly, identify and replace methods in your php file (remember to make a copy!). For example, if you want to intercept mail(), you can find mail( and replace ...


3

I found out that there is no specification of what the PHP bytecode should look like, so vendors implement it differently. So technically there is no such thing as "php bytecode", it only exists when talking about a particular engine, e.g. "zend bytecode".


2

how would I go about decoding/decrypting PHP code which is encoded/encrypted using eAccelerator? You would have to reverse engineer the eaccelerator_load() function in eAccelerator. Note that this function only exists in older versions of eAccelerator. For example, see here for the function as it existed in version 0.9.4: https://github.com/eaccelerator/...


2

use a script like this to get a beautified php code edit do not use jsbeautier install pear and use PHP_Beautifier instead there are lot of white space differences between PHP_Beautifier and jsbeautifier some of them are fatal like below or better use one of the online services like unphp $tpl - > $pdo instead of $tpl->$pdo (notice the space ...


1

Every single variable name has been randomized. Unless he gives you the source without the randomized names, you'll have to rename every variable by yourself in your php files if you want to get something that's easily readable. The best I can do for you is format it and fix some issues with text quotes to make it a little bit more readable. <?php ${"...


1

Here's your deobfuscated file, note that I do not give guarantees, there was some manual work done and I may have removed important lines, more on that below: <? if (isset($_SESSION['id'])) { header('Location: ../'); exit(); } $message = ''; if (isset($_GET['data']) && isset($_GET['a'])) { $id = check($_GET['a'], "int"); $STH = ...


1

This is not that hard task as one can image, only a bit tedious. First, you should reformat those files to have some of the structure reconstructed https://gist.github.com/pawlos/bd3838d04cbbe094e534c5bd8b532b69 With only such small task you can see some SQL queries that go to the DB for user and password data. From that, you can start renaming the ...


1

You can add the HTTP proxy Fiddler to the list if they use a HTTP protocol


Only top voted, non community-wiki answers of a minimum length are eligible